@dcoderlt https://www.justice.gov/usao-edny/pr/russian-cybercriminal-sentenced-10-years-prison-digital-advertising-fraud-scheme
I deliberately infected a laptop with the malware proxy they were using, then injected a bespoke piece of code that got the bots' IP addresses via flash using RTSP.
Sent that to the feds and they worked with interpol to get a warrant.